4 ms·

In theory it is possible to run a bitcoin tor marketplace anonymously, but in practice, given a long enough timeline, mistakes will happen and chances of gettin

In theory it is possible to run a bitcoin tor marketplace anonymously, but in practice, given a long enough timeline, mistakes will happen and chances of getting caught approach 100%. I wonder what mistakes were made here.

Shared404 6y ago
I would also like a report/postmortem. I think we are unlikely to get one however, at least not anytime soon.
0xy 6y ago
You'll never know the real timeline because law enforcement lie about the use of parallel construction to build cases. We know that Tor isn't resistant to state-based attackers, so my money is always on global surveillance networks picking up missteps by the operators. "Whoops I forgot to turn my VPN on and SSH'ed into one of the servers they were already watching" -- this kind of thing.
- de_nied 6y ago
  >"Whoops I forgot to turn my VPN on" Why would someone be using a VPN if they're using tor for the market? Why would a VPN offer any protection at all? If you're using a VPN and "SSH into one of the servers that they are already watching", then a VPN isn't going to provide anonymity.
  - Shared404 6y ago
    The model would be something like User --> VPN --> Tor --> Market Assuming the VPN is trustworthy and you don't connect to Tor without it, the VPN would cover up the fact that you used Tor at all. If you normally use the VPN, but forget it one time, you are now exposed.
    - bauruine 6y ago
      If they are able to do a deanonymization attack on the 3 hop Tor circuit why should a VPN protect you? They can just mount a similar attack on the one hop VPN.
      - Shared404 6y ago
        Thus the requirement for the VPN to be trustworthy. What that means changes on the threat model, but for this scenario we'll say a hypothetical VPN provider in a different jurisdiction that takes Monero and has good OpSec. The reason they can do the deanonymization attack on the Tor circuit is that they have basically unlimited resources to set up nodes, and Tor is built on the assumption that the nodes are all unrelated. If a Tor session looks like: User -> VPN -> Tor( A -> B -> C ) -> Market then the government could have the advantage of owning both A and B, or any other combination. That is difficult (though not impossible) to do to a VPN that they do not have jurisdiction over. Anyone can set up a Tor node, but it's not possible to just randomly add nodes to a VPN's network, so they shouldn't be vulnerable to that (barring insecurity in other forms).
        de_nied 6y ago
        Check my other reply. I don't think you understand how deanonymization attacks work. It's not by governments "owning nodes." They might sometimes run the exit node, but that's for detecting certain activity, not finding people. Plus, you can restrict what nodes are used. It's not like the public nodes are the only ones that exist.
        Shared404 6y ago
        Thanks, I appreciate it. Clearly I've got gaps in my understanding, any good resources you could point me towards to study up?
        de_nied 6y ago
        I'd check out Wikipedia categories for general pointers. I think it's important to highlight that internet privacy and internet anonymity are two very different things. Also take care on how the word anonymous is used. Some use the word "pseudo-anonymous" which isn't the same thing. It'd also be helpful to first learn how routing works. Then check out different types of applications(Tor, AnoNet, ZeroNet, etc) and read up on how they implement their networks. Also read up on how the people who ran the markets got caught (read up articles in addition to Wikipedia). Be aware Wikipedia shouldn't be used as actual fact. Check the sources. Many editors misinterpret them, or don't even read them at all. https://en.wikipedia.org/wiki/Category:Internet_privacy https://en.wikipedia.org/wiki/Category:Internet_privacy https://en.wikipedia.org/wiki/Category:Anonymity_networks https://en.wikipedia.org/wiki/Category:Anonymity_networks https://en.wikipedia.org/wiki/Routing https://en.wikipedia.org/wiki/Routing Some keywords/concepts that may help: I2P/Peer-to-peer/Friend-to-friend/ Onion routing Garlic routing Digital fingerprinting https://en.wikipedia.org/wiki/Mix_network https://en.wikipedia.org/wiki/Mix_network https://en.wikipedia.org/wiki/Crowds_(anonymity_network) https://en.wikipedia.org/wiki/Crowds_(anonymity_network) https://en.wikipedia.org/wiki/ZeroNet https://en.wikipedia.org/wiki/ZeroNet https://en.wikipedia.org/wiki/Anonymous_P2P https://en.wikipedia.org/wiki/Anonymous_P2P Tails/Whonix/QubeOS for system protection.
    - de_nied 6y ago
      A VPN would not cover up the fact that you used Tor at all. Assuming you're actually utilizing SSH through sock proxies and using a VPN, you can still be fingerprinted and tracked. There are already existing databases that have established profiles for various sites. Your ISP can easily see if you're connecting to one of those sites based on the type of data you're sending. Regardless if it's encrypted. On the other hand, if you normally do this but forget to one time, it doesn't mean you're automatically exposed. It simply means that if anyone is currently attempting to find you and have an exploit that will actually work on you, then they will be getting you directly instead of your VPN. However, even if you had a VPN, if it's a government agency then generally speaking they will be able to find you anyways. A VPN doesn't "hide" you. It's not meant to. If you want to stay anonymous, there are several methods that can be utilized. The most obvious one is not connecting to the internet from your own home. Use the Starbucks WiFi. A more clever method would be buying slave bots and using poorly secured wifi netowrks around them to hop over one. Assume VPN connections are from companies based in countries not on friendly terms with yours. Like China/U.S. User -> RandomWifi -> VPN/SSH -> Slave -> SecondSlave/WifiHop -> VPN/SSH 2.0 -> Tor -> Market This is a very basic set up. I would personally add more to it with other stuff, but it all depends on your threat model. Small note. This assumes you're actually setting up your VPNs, not buying some "VPN service." I saw you wrote about being careful with VPNs and how "trustworthy" they are. I'm not sure why you would ever use a VPN service.
      - grenoire 6y ago
        >I'm not sure why you would ever use a VPN service. Geolocking. That seems to be the only 'accepted' technical answer.
      - patrickaljord 6y ago
        > User -> RandomWifi -> VPN/SSH -> Slave -> SecondSlave/WifiHop -> VPN/SSH 2.0 -> Tor -> Market One thing I would add to the RandomWifi at starbucks is to make sure not to bring your phone as they could detect you went there if they get to find your RandomWifi starbucks location. Also make sure to change starbucks/RandomWifi location every time and for extra-paranoid reasons, maybe wear some toupee and fake moustache in case they try to get camera recording from the starbucks. I would also do most of the work from home, just run all the db/code updates from home and then sync/push the update at RandomWifi so you just need to stay there a few seconds. You don't even need to get in, just stay outside walking and click the push button from your laptop quickly. Never do it on the same hours either.
Scoundreller 6y ago
> given a long enough timeline There's an opportunity. Marketplaces that will exist for X days only.
- forgingahead 6y ago
  Unlikely - ever tried to get a gambler on a winning streak to "stop while he's ahead"?
  - hunter2_ 6y ago
    I was thinking it sounds more like hopping to another roulette table when the one you're on is getting too hot. Complete fallacy other than a potential placebo effect that somehow encourages saner unrelated decisions.
  - de_nied 6y ago
    These markets actually already exist. However, the owners are generally just cashing in and screwing everyone over for whatever crypto is currently being held.
  - Moru 6y ago
    Scammers is not gamblers really, they just do their scam and move on to the next scam.
  - FDSGSG 6y ago
    This is most markets. Arrests of market operators are not very common, usually they exit at some point and are never heard of again.
- bigiain 6y ago
  aka "exit scam"
__MatrixMan__ 6y ago
Exit scams are also a problem whose likelihood increases with time. Either the fed's bust in and take the user's money, or the market makers take off with the user's money, or both sides wait for the pot to get bigger. It kinda seems like fees and taxes, but instead of paying them on every transaction the users gamble on whether they'll be the one stuck with the bill. I'm also interested in the particular opsec failure for this iteration, I just think don't think it's the only factor.
- FDSGSG 6y ago
  >I'm also interested in the particular opsec failure for this iteration The person running this site did not have anything near the technical skills required to operate a darknet market. Instead of developing his own, he used a very clunky public script for his market https://github.com/5auth/eckmar-source https://github.com/5auth/eckmar-source All of the early posts by /u/darkmarket on Dread were in /d/darknetmarketsAU. Very early on other users figured out his previous handle he used as a drug vendor. DarkMarket was plagued by repeated IP leaks of its servers, and had its servers seized in the 2019 Cyberbunker raid. https://twitter.com/SttyK/status/1349034993893265408 https://twitter.com/SttyK/status/1349034993893265408 https://twitter.com/5auth/status/1349358474476613633 https://twitter.com/5auth/status/1349358474476613633 https://twitter.com/SttyK/status/1349261670477045760 https://twitter.com/SttyK/status/1349261670477045760
  - comboy 6y ago
    I think owners who are not security pros may be more common because when somebody knows enough and have been doing it for some time, he may realize that with all his skill he still can be owned one way or another (and he will be given long enough time and high enough incentives).
    - FDSGSG 6y ago
      Or maybe because there are just far more amateurs than actual security pros out there? Dream market remained online for 7 years and shut down gracefully after the administrator got tired of dealing with DDoS attacks, odds are the site earned closer to $100M even if you ignore bitcoin appreciation. >and he will be given long enough time and high enough incentives You only have to last a couple of years to make tens of millions, Empire Market exited the business with over $30 million after two years.
juskrey 6y ago
Yeah, there is a huge asymmetry: a lawbreaker has limited tolerance to errors (one will suffice), a law enforcer has basically unlimited error resource.

Shared404 6y ago

I would also like a report/postmortem. I think we are unlikely to get one however, at least not anytime soon.

0xy 6y ago

You'll never know the real timeline because law enforcement lie about the use of parallel construction to build cases. We know that Tor isn't resistant to state-based attackers, so my money is always on global surveillance networks picking up missteps by the operators. "Whoops I forgot to turn my VPN on and SSH'ed into one of the servers they were already watching" -- this kind of thing.

de_nied 6y ago
>"Whoops I forgot to turn my VPN on" Why would someone be using a VPN if they're using tor for the market? Why would a VPN offer any protection at all? If you're using a VPN and "SSH into one of the servers that they are already watching", then a VPN isn't going to provide anonymity.
- Shared404 6y ago
  The model would be something like User --> VPN --> Tor --> Market Assuming the VPN is trustworthy and you don't connect to Tor without it, the VPN would cover up the fact that you used Tor at all. If you normally use the VPN, but forget it one time, you are now exposed.
  - bauruine 6y ago
    If they are able to do a deanonymization attack on the 3 hop Tor circuit why should a VPN protect you? They can just mount a similar attack on the one hop VPN.
    - Shared404 6y ago
      Thus the requirement for the VPN to be trustworthy. What that means changes on the threat model, but for this scenario we'll say a hypothetical VPN provider in a different jurisdiction that takes Monero and has good OpSec. The reason they can do the deanonymization attack on the Tor circuit is that they have basically unlimited resources to set up nodes, and Tor is built on the assumption that the nodes are all unrelated. If a Tor session looks like: User -> VPN -> Tor( A -> B -> C ) -> Market then the government could have the advantage of owning both A and B, or any other combination. That is difficult (though not impossible) to do to a VPN that they do not have jurisdiction over. Anyone can set up a Tor node, but it's not possible to just randomly add nodes to a VPN's network, so they shouldn't be vulnerable to that (barring insecurity in other forms).
      - de_nied 6y ago
        Check my other reply. I don't think you understand how deanonymization attacks work. It's not by governments "owning nodes." They might sometimes run the exit node, but that's for detecting certain activity, not finding people. Plus, you can restrict what nodes are used. It's not like the public nodes are the only ones that exist.
        Shared404 6y ago
        Thanks, I appreciate it. Clearly I've got gaps in my understanding, any good resources you could point me towards to study up?
        de_nied 6y ago
        I'd check out Wikipedia categories for general pointers. I think it's important to highlight that internet privacy and internet anonymity are two very different things. Also take care on how the word anonymous is used. Some use the word "pseudo-anonymous" which isn't the same thing. It'd also be helpful to first learn how routing works. Then check out different types of applications(Tor, AnoNet, ZeroNet, etc) and read up on how they implement their networks. Also read up on how the people who ran the markets got caught (read up articles in addition to Wikipedia). Be aware Wikipedia shouldn't be used as actual fact. Check the sources. Many editors misinterpret them, or don't even read them at all. https://en.wikipedia.org/wiki/Category:Internet_privacy https://en.wikipedia.org/wiki/Category:Internet_privacy https://en.wikipedia.org/wiki/Category:Anonymity_networks https://en.wikipedia.org/wiki/Category:Anonymity_networks https://en.wikipedia.org/wiki/Routing https://en.wikipedia.org/wiki/Routing Some keywords/concepts that may help: I2P/Peer-to-peer/Friend-to-friend/ Onion routing Garlic routing Digital fingerprinting https://en.wikipedia.org/wiki/Mix_network https://en.wikipedia.org/wiki/Mix_network https://en.wikipedia.org/wiki/Crowds_(anonymity_network) https://en.wikipedia.org/wiki/Crowds_(anonymity_network) https://en.wikipedia.org/wiki/ZeroNet https://en.wikipedia.org/wiki/ZeroNet https://en.wikipedia.org/wiki/Anonymous_P2P https://en.wikipedia.org/wiki/Anonymous_P2P Tails/Whonix/QubeOS for system protection.
  - de_nied 6y ago
    A VPN would not cover up the fact that you used Tor at all. Assuming you're actually utilizing SSH through sock proxies and using a VPN, you can still be fingerprinted and tracked. There are already existing databases that have established profiles for various sites. Your ISP can easily see if you're connecting to one of those sites based on the type of data you're sending. Regardless if it's encrypted. On the other hand, if you normally do this but forget to one time, it doesn't mean you're automatically exposed. It simply means that if anyone is currently attempting to find you and have an exploit that will actually work on you, then they will be getting you directly instead of your VPN. However, even if you had a VPN, if it's a government agency then generally speaking they will be able to find you anyways. A VPN doesn't "hide" you. It's not meant to. If you want to stay anonymous, there are several methods that can be utilized. The most obvious one is not connecting to the internet from your own home. Use the Starbucks WiFi. A more clever method would be buying slave bots and using poorly secured wifi netowrks around them to hop over one. Assume VPN connections are from companies based in countries not on friendly terms with yours. Like China/U.S. User -> RandomWifi -> VPN/SSH -> Slave -> SecondSlave/WifiHop -> VPN/SSH 2.0 -> Tor -> Market This is a very basic set up. I would personally add more to it with other stuff, but it all depends on your threat model. Small note. This assumes you're actually setting up your VPNs, not buying some "VPN service." I saw you wrote about being careful with VPNs and how "trustworthy" they are. I'm not sure why you would ever use a VPN service.
    - grenoire 6y ago
      >I'm not sure why you would ever use a VPN service. Geolocking. That seems to be the only 'accepted' technical answer.
    - patrickaljord 6y ago
      > User -> RandomWifi -> VPN/SSH -> Slave -> SecondSlave/WifiHop -> VPN/SSH 2.0 -> Tor -> Market One thing I would add to the RandomWifi at starbucks is to make sure not to bring your phone as they could detect you went there if they get to find your RandomWifi starbucks location. Also make sure to change starbucks/RandomWifi location every time and for extra-paranoid reasons, maybe wear some toupee and fake moustache in case they try to get camera recording from the starbucks. I would also do most of the work from home, just run all the db/code updates from home and then sync/push the update at RandomWifi so you just need to stay there a few seconds. You don't even need to get in, just stay outside walking and click the push button from your laptop quickly. Never do it on the same hours either.

Scoundreller 6y ago

> given a long enough timeline There's an opportunity. Marketplaces that will exist for X days only.

forgingahead 6y ago
Unlikely - ever tried to get a gambler on a winning streak to "stop while he's ahead"?
- hunter2_ 6y ago
  I was thinking it sounds more like hopping to another roulette table when the one you're on is getting too hot. Complete fallacy other than a potential placebo effect that somehow encourages saner unrelated decisions.
- de_nied 6y ago
  These markets actually already exist. However, the owners are generally just cashing in and screwing everyone over for whatever crypto is currently being held.
- Moru 6y ago
  Scammers is not gamblers really, they just do their scam and move on to the next scam.
- FDSGSG 6y ago
  This is most markets. Arrests of market operators are not very common, usually they exit at some point and are never heard of again.
bigiain 6y ago
aka "exit scam"

__MatrixMan__ 6y ago

Exit scams are also a problem whose likelihood increases with time. Either the fed's bust in and take the user's money, or the market makers take off with the user's money, or both sides wait for the pot to get bigger. It kinda seems like fees and taxes, but instead of paying them on every transaction the users gamble on whether they'll be the one stuck with the bill. I'm also interested in the particular opsec failure for this iteration, I just think don't think it's the only factor.

FDSGSG 6y ago
>I'm also interested in the particular opsec failure for this iteration The person running this site did not have anything near the technical skills required to operate a darknet market. Instead of developing his own, he used a very clunky public script for his market https://github.com/5auth/eckmar-source https://github.com/5auth/eckmar-source All of the early posts by /u/darkmarket on Dread were in /d/darknetmarketsAU. Very early on other users figured out his previous handle he used as a drug vendor. DarkMarket was plagued by repeated IP leaks of its servers, and had its servers seized in the 2019 Cyberbunker raid. https://twitter.com/SttyK/status/1349034993893265408 https://twitter.com/SttyK/status/1349034993893265408 https://twitter.com/5auth/status/1349358474476613633 https://twitter.com/5auth/status/1349358474476613633 https://twitter.com/SttyK/status/1349261670477045760 https://twitter.com/SttyK/status/1349261670477045760
- comboy 6y ago
  I think owners who are not security pros may be more common because when somebody knows enough and have been doing it for some time, he may realize that with all his skill he still can be owned one way or another (and he will be given long enough time and high enough incentives).
  - FDSGSG 6y ago
    Or maybe because there are just far more amateurs than actual security pros out there? Dream market remained online for 7 years and shut down gracefully after the administrator got tired of dealing with DDoS attacks, odds are the site earned closer to $100M even if you ignore bitcoin appreciation. >and he will be given long enough time and high enough incentives You only have to last a couple of years to make tens of millions, Empire Market exited the business with over $30 million after two years.

juskrey 6y ago

Yeah, there is a huge asymmetry: a lawbreaker has limited tolerance to errors (one will suffice), a law enforcer has basically unlimited error resource.